Read the docs
TI-2017-02990 Aliases CVE-2017-3894GHSA-pwh9-jfx5-xfp8

Cross-site scripting in BlackBerry Unified Endpoint Manager

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.

Why it matters now

EPSS 0.00846 58th percentileScored 2026-11-07
Fix Fixed Unified Endpoint Manager (BlackBerry): 12.6.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BlackBerryUnified Endpoint Managerbefore 12.6.212.6.2Patch availableCNA
BlackBerryBES12all versions—No fix listedCNA
  • Unified Endpoint Manager VendorBlackBerry Affected before 12.6.2 Fixed in 12.6.2 Patch available CNA
  • BES12 VendorBlackBerry Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:blackberry:enterprise_service:12.0:*:*:*:*:*:*:*12.0VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.0.1:*:*:*:*:*:*:*12.0.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.1:*:*:*:*:*:*:*12.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.1.1:*:*:*:*:*:*:*12.1.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.2.0:*:*:*:*:*:*:*12.2.0VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.2.1:*:*:*:*:*:*:*12.2.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.3.0:*:*:*:*:*:*:*12.3.0VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.3.1:*:*:*:*:*:*:*12.3.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableBlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.2.1:*:*:*:*:*:*:* Versions 12.2.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.3.1:*:*:*:*:*:*:* Versions 12.3.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·BlackBerry
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:blackberry:enterprise_service:12.4.1:*:*:*:*:*:*:*12.4.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.5.1:*:*:*:*:*:*:*12.5.1VulnerableBlackBerry
cpe:2.3:a:blackberry:enterprise_service:12.5.2:*:*:*:*:*:*:*12.5.2VulnerableBlackBerry
cpe:2.3:a:blackberry:unified_endpoint_manager:*:*:*:*:*:*:*:*up to 12.6.1VulnerableBlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.4.1:*:*:*:*:*:*:* Versions 12.4.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.5.1:*:*:*:*:*:*:* Versions 12.5.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:enterprise_service:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:unified_endpoint_manager:*:*:*:*:*:*:*:* Versions up to 12.6.1 Vulnerable ·BlackBerry

Remediation

  • Fix · CNA Unified Endpoint Manager (BlackBerry) Fixed in 12.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3894
  2. 2026-10-03 Alias added: GHSA-pwh9-jfx5-xfp8

References

Advisory 1

  • TI-2016-02624 Information disclosure in BES12 versions through 12.5.2 CVSS 3.0HIGH 8.1
  • TI-2016-02622 A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through… CVSS 3.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences